From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from v1.tansi.org (mail.tansi.org [84.19.178.47]) by mail.server123.net (Postfix) with ESMTP for ; Sat, 2 Jul 2016 12:20:01 +0200 (CEST) Received: from gatewagner.dyndns.org (77-56-144-126.dclient.hispeed.ch [77.56.144.126]) by v1.tansi.org (Postfix) with ESMTPA id F40FE14005B for ; Sat, 2 Jul 2016 12:19:59 +0200 (CEST) Date: Sat, 2 Jul 2016 12:20:00 +0200 From: Arno Wagner Message-ID: <20160702102000.GA22828@tansi.org> References: <655760b1-5f92-e6f5-50c1-d46edef89cd9@braegelmann.net> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable In-Reply-To: <655760b1-5f92-e6f5-50c1-d46edef89cd9@braegelmann.net> Subject: Re: [dm-crypt] Incidentaly partitioned LUKS device - header lost? List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Hi Bernd, data-recovery for this is typically relatively easy or completely impossible. To determine which it is, we need to find out what=20 happened exactly. The only really irreplaceable values in the header are the salts (see FAQ Item 6.12). These are not secret, but=20 each is 256 bits of crypto-grade randomness and they cannot be reconstructed or guessed. The first question is what was overwritten by that partition=20 sector. Traditionally, Linux software RAID has the RAID superblock at the end, but unfortunately some people "improved" this, so it can now be at the end, at the start and at 4kB from the start. This is relevant becauese it influences the data offset, i.e. the place where the LUKS header is put. Hence we need the output of mdadm --detail /dev/md2 whichs dumps the RAID metadata. Regards, Arno On Sat, Jul 02, 2016 at 08:33:09 CEST, Bernd Br=E4gelmann wrote: > Hi there, >=20 > i think i destroyed my luks data. >=20 > I accidentally created a msdos partition table on the luks device. I > think the device was not partitioned. The device is a raid5 mdadm at > /dev/md2. >=20 > Now i cannot luksOpen the device anymore. >=20 > I already try to hexdump|grep for the LUKS header but until now i > haven't found it. In the Luks-FAQ 6.1 the problem is described as a > common user error and it is very common that the partitioning has > destroyed the LUKS header. >=20 > My question is: Is my data destroyed beyond recovery? It would really > help me to cope with this. Is it possible to "manually" fix a partially > destroyed LUKS header? Are there other ways to recover the data? I would > gladly pay for a recovery solution. >=20 > Regards, >=20 > Bernd >=20 > --=20 > Bernd Br=E4gelmann - FA f=FCr Radiologie > Robert-Koch-Stra=DFe 42 28277 Bremen > www.berndbraegelmann.de +4915141457796 > _______________________________________________ > dm-crypt mailing list > dm-crypt@saout.de > http://www.saout.de/mailman/listinfo/dm-crypt --=20 Arno Wagner, Dr. sc. techn., Dipl. Inform., Email: arno@wagner.name GnuPG: ID: CB5D9718 FP: 12D6 C03B 1B30 33BB 13CF B774 E35C 5FA1 CB5D 9718 ---- A good decision is based on knowledge and not on numbers. -- Plato If it's in the news, don't worry about it. The very definition of=20 "news" is "something that hardly ever happens." -- Bruce Schneier